Before I created my B2C Tenant, I was using an ordinary tenant. With ordinary tenant, I registered SP app, created a SAML IdP configuration, and sign in and sign up user flow. When I opening my SP app and trying to login, it was opening the login.microsoftonline.com and I was logging in with an email of federated IdP domain name of SAML IdP configuration. Then, it redirected me to my IdP as a guest. Now I want to achieve the same behavior with my B2C Tenant. I have already created and switched to my B2C Tenant. Registered SP Application. Added custom Identity Provider configuring with openid-connect with my Keycloak IdP (It did not ask me federated domain name of IdP) Created a user flow and selected my created custom IdP Now when I open my SP application with B2C Tenant's configurations, I am getting "This username may be incorrect. Make sure you typed it correctly. Otherwise, contact your admin." error message when trying to login with emails of such domains as idp.dev.digitaltrust.net (federated domain name of my IdP) or digitaltrustnetworks.onmicrosoft.com (B2C Tenant's domain name). P.S. I followed all steps of this document and tested the user flow getting expected result (It redirects me to my IdP). How can I achieve this with a guest user? What domain should I use or how can I strict use my user flow for authentication?

Cannot be redirected to my configured IdP using B2C Tenant

Artyom Vancyan 1

Before I created my B2C Tenant, I was using an ordinary tenant.

With ordinary tenant, I registered SP app, created a SAML IdP configuration, and sign in and sign up user flow.
When I opening my SP app and trying to login, it was opening the login.microsoftonline.com and I was logging in with an email of federated IdP domain name of SAML IdP configuration. Then, it redirected me to my IdP as a guest.

Now I want to achieve the same behavior with my B2C Tenant.

I have already created and switched to my B2C Tenant.
Registered SP Application.
Added custom Identity Provider configuring with openid-connect with my Keycloak IdP (It did not ask me federated domain name of IdP)
Created a user flow and selected my created custom IdP

Now when I open my SP application with B2C Tenant's configurations, I am getting "This username may be incorrect. Make sure you typed it correctly. Otherwise, contact your admin." error message when trying to login with emails of such domains as idp.dev.digitaltrust.net (federated domain name of my IdP) or digitaltrustnetworks.onmicrosoft.com (B2C Tenant's domain name).

P.S. I followed all steps of this document and tested the user flow getting expected result (It redirects me to my IdP). How can I achieve this with a guest user? What domain should I use or how can I strict use my user flow for authentication?

Shweta Mathur 27,941 Reputation points Microsoft Employee

2022-08-24T13:14:56.04+00:00

Hi @Artyom Vancyan ,

Thanks for reaching out.

We are working on this and will get back to you.

Thanks,
Shweta
Artyom Vancyan 1 Reputation point

2022-08-24T14:07:49.963+00:00

Hi @Shweta Mathur , I have solved the problem following this documentation. Now my SP application is the user flow I created.

Now I am facing another issue. I want to provide login_hint to a particular IdP. How can I do that?
Shweta Mathur 27,941 Reputation points Microsoft Employee

2022-08-25T07:17:58.327+00:00

@Artyom Vancyan ,

Glad you are able to resolve your earlier issue.

For social Identity providers, you need to provide domain_hint=domain_name in the URL which will redirect directly to the IDP.
eg- To redirect directly to the google IdP, it should be domain_hint=google.com.

Login_hint should be defined in case of prepopulating the sign in name.

Hope this will help.

Thanks,
Shweta
Artyom Vancyan 1 Reputation point

2022-08-25T07:49:14.943+00:00
@Shweta Mathur ,

I have already read about domain_hint and its usage. I set the domain hint of my custom opened IdP, and I want to get the following user flow.

Open the login page (login.microsoftonline.com) and fill the email field.

Despite what email I put there, I expect it to redirect me to the IdP (by domain_hint), providing the email as a login_hint.

I know that I can achieve this by using custom policies. Now I am experimenting with TrustFrameworkBase.xml but cannot find any useful documentation or links.

It would be very appreciated if you can help me to achieve the above-described user flow.

Thanks, Artyom.
Artyom Vancyan 1 Reputation point

2022-08-25T13:04:16.417+00:00

I would like to connect with you by email or live chat to solve my special case. If it is possible, please let me know.